Sealed forte-drop-secrets with the real UpCloud Managed Object Storage creds (existing drops bucket), PG creds matching the deployed forte-drop-pg-creds, and PASSWORD_GATE_SECRET. Consumed by both web + mcp deployments (envSecretName) and the pg-backup CronJob (S3 creds).